Password Encryption

Password encryption is the process of transforming a password into an unreadable format (ciphertext) to protect it from unauthorized access. It’s a critical part of securing user credentials in applications, databases, and systems.

Key Concepts

Encryption vs. Hashing: Encryption is reversible (with a key), while hashing is a one-way process that generates a fixed-length string (hash) from a password, designed to be irreversible. For passwords, hashing is typically preferred over encryption because even if the hash is compromised, the original password cannot be easily recovered.

Examples

Salt: A random string added to a password before hashing to ensure unique hashes, even for identical passwords. This defends against precomputed attacks like rainbow tables.

Key Derivation Functions (KDFs): Specialized algorithms (e.g., Argon2, PBKDF2) designed for secure password hashing by being computationally intensive, making brute-force attacks harder.

Common Password Hashing Algorithms

Argon2 (Recommended): Winner of the 2015 Password Hashing Competition.

Memory-hard and computationally intensive, resistant to GPU-based attacks.

Configurable parameters for memory, iterations, and parallelism.

Use case: Modern applications requiring high security.

bcrypt

Widely used, adaptive (work factor increases with hardware improvements).

Automatically includes a salt.

Slower than older algorithms, good for resisting brute-force attacks.

Use case: Web applications, general-purpose password storage.

PBKDF2 (Password-Based Key Derivation Function 2)

Uses multiple iterations to slow down hashing.

Supports salting and configurable iteration counts.

Less memory-intensive than Argon2, so slightly less resistant to specialized hardware attacks.

Use case: Legacy systems or when Argon2 isn’t available.

SHA-256/SHA-512 (Not Recommended Alone)

Fast cryptographic hash functions, not designed for passwords.

Vulnerable to brute-force attacks on modern hardware unless combined with a high iteration count or salting (e.g., via PBKDF2).

Use case: Only in combination with KDFs, not standalone.

MD5 (Deprecated)

Fast but insecure due to vulnerabilities (collisions, preimage attacks).

Should not be used for password hashing.

Best Practices for Password Encryption/Hashing

Use a Strong Hashing Algorithm: Prefer Argon2 or bcrypt for modern systems. Avoid MD5 or SHA-1 due to their weaknesses.

Always Use a Salt: Generate a unique, random salt for each password (at least 16 bytes).

Store the salt alongside the hash (it doesn’t need to be secret).

Slow Down the Hashing Process: Use algorithms with configurable work factors (e.g., bcrypt’s cost factor, Argon2’s memory and iteration settings) to make brute-forcing impractical.

Balance performance with security: aim for ~100-500ms per hash on your server.

Store Hashes Securely

Store only the hash and salt in your database, never the plaintext password.

Use secure database configurations (e.g., access controls, encryption at rest).

Validate Passwords Securely

When verifying, hash the provided password with the stored salt and compare the result to the stored hash using a constant-time comparison to prevent timing attacks.

Implement Password Policies

Enforce minimum length (e.g., 12 characters) and complexity.

Encourage passphrases over complex passwords for better usability and security.

Use HTTPS

Ensure passwords are transmitted over encrypted channels to prevent interception.

Regularly Update Hashing Parameters

Increase work factors (e.g., bcrypt cost, Argon2 memory) as hardware improves.

Rehash passwords when users log in if parameters change.

Avoid Reversible Encryption for Passwords

Use hashing instead of encryption unless there’s a specific need for recovery (rare for passwords).

If encryption is required (e.g., for specific compliance), use strong algorithms like AES-256 with secure key management.

import bcrypt

# Password to hash
password = "MySecurePassword123".encode('utf-8')

# Generate a salt and hash the password
salt = bcrypt.gensalt(rounds=12)  # 12 is the work factor
hashed_password = bcrypt.hashpw(password, salt)

# Store hashed_password and salt in the database
print(hashed_password)

# To verify a password
user_input = "MySecurePassword123".encode('utf-8')
if bcrypt.checkpw(user_input, hashed_password):
    print("Password is correct!")
else:
    print("Password is incorrect!")